MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 04438cb66094a0908b767d0ca5c4fdde93cb57a15201fe78197e0fc744f3941a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	04438cb66094a0908b767d0ca5c4fdde93cb57a15201fe78197e0fc744f3941a
SHA3-384 hash:	874f54d690208f4aaca5f7bf708d8e872f2ef4f01b1d7732971e4ca2ab086c851fadf437a7bcea9489cfe6b360f58d7f
SHA1 hash:	b45c3490233bf769e1d2147a86dda7d2aa555dcf
MD5 hash:	d698b293e8bf768bcdf4027c2e07414a
humanhash:	river-solar-lithium-music
File name:	d698b293e8bf768bcdf4027c2e07414a.exe
Download:	download sample
Signature	AsyncRAT Alert Create hunting rule
File size:	77'824 bytes
First seen:	2022-08-05 17:00:28 UTC
Last seen:	2022-08-05 17:59:07 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (31'208 x AgentTesla, 10'508 x Formbook, 5'466 x SnakeKeylogger)
ssdeep	1536:JeH0MJaSaVr5hNEl4+iGiDKAGXUfbT+yjDzO/Je:gHHJa/Vrql4nGiDBvP+yjDMJe
TLSH	T1F0734A18BBEBC522E1AD9A7685E113454335E3537203DB4F2CC8039A4F23BC75F46A9A
TrID	61.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 11.0% (.SCR) Windows screen saver (13101/52/3) 8.8% (.EXE) Win64 Executable (generic) (10523/12/4) 5.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
Reporter	@abuse_ch
Tags:	AsyncRAT exe RAT

@abuse_ch

AsyncRAT C2:
185.225.73.183:4782

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

414

Origin country :

NL

Mail intelligence

No data

Vendor Threat Intelligence

ANY.RUN asyncrat

Malware family:

asyncrat

Alert

Create hunting rule

ID:

1

File name:

d698b293e8bf768bcdf4027c2e07414a.exe

Verdict:

Malicious activity

Analysis date:

2022-08-05 17:03:36 UTC

Tags:

trojan rat asyncrat

Link:

https://app.any.run/tasks/315a5418-03d9-46d2-b405-5b10acf73eaf

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/296748/

ClamAV Detected

Detection(s):

SecuriteInfo.com.BackDoor.AsyncRATNET.1.353.25539.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

DNS request

Sending a custom TCP request

Using the Windows Management Instrumentation requests

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-vm asyncrat bladabindi packed packed

Link:

https://www.filescan.io/uploads/62ed4cd026369c8856695bc4/reports/bf56fd3f-4a4e-4481-9044-e0cdef1e92a6/overview

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Malicious

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/7e446f67-fba7-4b0a-a694-73835d79b8e9

Joe Sandbox AsyncRAT

Result

Threat name:

AsyncRAT

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

96 / 100

Link:

https://www.joesandbox.com/analysis/1046934

Signature

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

Antivirus / Scanner detection for submitted sample

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected AsyncRAT

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB asyncrat

Detection:

asyncrat

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/04438cb66094a0908b767d0ca5c4fdde93cb57a15201fe78197e0fc744f3941a/

ReversingLabs TitaniumCloud ByteCode-MSIL.Backdoor.Bladabhindi

Threat name:

ByteCode-MSIL.Backdoor.Bladabhindi

Alert

Create hunting rule

Status:

Malicious

First seen:

2022-08-05 01:12:00 UTC

File Type:

PE (.Net Exe)

Extracted files:

4

AV detection:

22 of 26 (84.62%)

Threat level:

  5/5

Spamhaus Hash Blocklist

Detection(s):

Malicious file

Link:

https://www.spamhaus.org/query/hash/arbyzntassqjbc3wpugklrh532j4wv5bkia746azpyh4orhtsqna._file

Threatray malicious

Verdict:

malicious

Hatching Triage asyncrat

Result

Malware family:

asyncrat

Alert

Create hunting rule

Score:

  10/10

Tags:

family:asyncrat rat

Link:

https://tria.ge/reports/220805-vjh9rsfca3/

Behaviour

Suspicious use of AdjustPrivilegeToken

Async RAT payload

AsyncRat

UnpacMe win_asyncrat_w0

Unpacked files

SH256 hash:

04438cb66094a0908b767d0ca5c4fdde93cb57a15201fe78197e0fc744f3941a

MD5 hash:

d698b293e8bf768bcdf4027c2e07414a

SHA1 hash:

b45c3490233bf769e1d2147a86dda7d2aa555dcf

Detections:

win_asyncrat_w0

Alert

Create hunting rule

Link:

https://www.unpac.me/results/6b9e5892-cb6a-4874-9114-2ec0c8194434/

VirusTotal 54.93%

AV coverage:

54.93%

AV detections:

39 / 71

Link:

https://www.virustotal.com/gui/file/04438cb66094a0908b767d0ca5c4fdde93cb57a15201fe78197e0fc744f3941a/detection/f-04438cb66094a0908b767d0ca5c4fdde93cb57a15201fe78197e0fc744f3941a-1659637505

YOROI YOMI iSpy Keylogger

Threat name:

iSpy Keylogger

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/04438cb66094a0908b767d0ca5c4fdde93cb57a15201fe78197e0fc744f3941a

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AsyncRAT

exe 04438cb66094a0908b767d0ca5c4fdde93cb57a15201fe78197e0fc744f3941a

(this sample)

  

URLhaus

https://urlhaus.abuse.ch/url/2264085/

  

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/296748/

  

URLhaus

https://urlhaus.abuse.ch/url/2264027/